Sysdig

Sysdig, Inc. is a cloud security vendor whose Sysdig Secure platform is a cloud-native application protection platform (CNAPP) unifying prevention, detection, and response across containers and Kubernetes, identities, workloads, and cloud services. The platform's core premise is runtime visibility: rather than inferring risk from configurations, code, and cloud APIs alone, Sysdig captures live system calls at the Linux kernel level to determine what is actually executing, and uses that signal to distinguish exploitable risk from theoretical risk. Product areas listed by the company include cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), vulnerability management, container workload protection, container and Kubernetes security, cloud detection and response, data security posture management, AI workload security, and on-premises/air-gapped and private cloud security.

Platform components include the Cloud Attack Graph (risk prioritization and attack-path mapping across resources), Resource 360 and inventory search for unified asset visibility, agent and agentless deployment options, and real-time detections combining drift control, machine learning, and Falco rules maintained by the Sysdig Threat Research Team. A more recent layer, Sysdig Secure AI, adds a GenAI Assistant for natural-language questions and guidance, autonomous "agentic" workflows, and "headless cloud security" in which customers compose security workflows through their own AI agents via curated agent skills and an MCP server rather than the vendor's UI.

Sysdig also maintains a substantial open source footprint. It created the sysdig OSS system-visibility/DFIR tool (Apache 2.0 licensed, hosted on GitHub under the draios organization) and Falco, which it contributed to the CNCF; it co-develops and supports Wireshark and Stratoshark, and supports ecosystem projects including eBPF and Prometheus. The company reports contributing 500+ detection rules and 150,000 lines of code to the CNCF.

Founding story

Founder Loris Degioanni, a computer engineering PhD from Politecnico di Torino, collaborated with Wireshark creator Gerald Combs and developed WinPcap, which brought Wireshark to Windows. In 2013 he founded Sysdig to give developers and defenders visibility into what is actually running, starting as an open source project providing deep, system call-level introspection into containers before growing into a commercial platform.

Business model

Commercial SaaS security software built on an open source foundation: free open source projects (sysdig OSS, Falco, Stratoshark, Wireshark support) sit alongside the paid Sysdig Secure platform, historically also Sysdig Monitor. The company sells to enterprises and, as of late 2021, moved all deals outside the Global 500 to an indirect/partner motion.

Subscription/recurring revenue from the Sysdig platform; the company disclosed annual recurring revenue metrics and net revenue retention in 2021, indicating a per-customer subscription model with expansion.

Traction

As of December 2021 the company reported nearly 700 customers (up 140% year over year), 149% annual net revenue retention in the most recent quarter, average ARR above $875,000 across its top 50 customers, security annualized revenue run rate more than tripling in 12 months, a 300% increase in Sysdig Secure sales over 12 months, SaaS hosting locations expanded from nine to 16, and Falco downloads exceeding 37 million (up 335% since becoming a CNCF incubating project in January 2020). The sysdig OSS GitHub repository shows roughly 8,300 stars and 753 forks. Marketing materials cite customer outcomes of 95% time saved on vulnerability management, 98% reduction in vulnerability noise, 6:1 tool consolidation, 20% time savings, and threat detection in under two seconds.

Latest developments

Current site materials center on Sysdig Secure AI, comprising Headless Cloud Security (workflows driven by customers' own AI agents), Sysdig Agentic AI (autonomous agents pursuing customer-defined outcomes), and the Sysdig GenAI Assistant, plus curated agent skills and an MCP server that connect the platform to third-party AI coding and security agents. Sysdig was named a Leader in The Forrester Wave: Cloud Native Application Protection Solutions, Q1 2026, and publishes a 2026 Cloud-Native Security and Usage Report and AI workload security guidance. The company also launched an open source community program unifying Falco, sysdig OSS, Wireshark, and Stratoshark.